I need to compare the number of unique user connections in two time intervals: 1) for all time; 2) for all time without the last hour.
Now my search query looks like this, but it does not work correctly:
sourcetype = * earliest = 1 latest = now()
| stats count(DeviceID) as DeviceID_ALL by Login
[sourcetype = * earliest = 1 latest = -1h@h | stats count(DeviceID) as DeviceID_withoutlasthour by Login]
| table Login, DeviceID_ALL, DeviceID_withoutlasthour
If you can help me, I would be overly grateful.
Thanks in advance!